Veritas Advanced eDiscovery User Guide

Last Published:
Product(s): Enterprise Vault.cloud (Version Not Specified)
  1. About Veritas Advanced eDiscovery
    1.  
      Introducing Veritas Advanced eDiscovery
    2.  
      Advanced eDiscovery key features
    3.  
      About classification
    4.  
      Advanced eDiscovery term definitions
  2. Getting started with Advanced eDiscovery
    1.  
      What's new in this release
    2.  
      Logging on to Advanced eDiscovery
    3.  
      Logging off from Advanced eDiscovery
    4. About the Advanced eDiscovery user interface
      1. About the left navigation pane
        1.  
          Investigations tab
        2.  
          eDiscovery tab
      2.  
        About the title bar options
      3.  
        About the search bar
      4.  
        About the bottom navigation bar
      5.  
        About the Details pane
    5.  
      Accessing your own archived emails
  3. Advanced eDiscovery roles
    1.  
      About account roles and Advanced eDiscovery
    2.  
      Account role
    3.  
      Reviewer role
    4.  
      Administrator role
    5. Assigning roles for Advanced eDiscovery
      1.  
        Assigning the Reviewer role to an account
      2.  
        Assigning the Administrator role to an account
  4. Managing investigations
    1.  
      About Investigations
    2. About Targeted Collections
      1.  
        Configuring Targeted Collection for Microsoft Teams
      2.  
        Configuring Targeted Collection for OneDrive for Business
      3.  
        Configuring Targeted Collection for Enterprise Vault
    3.  
      About Managed Accounts
    4. About Searches in investigation
      1.  
        Creating a new search
      2.  
        Saving searches as on-going and standard searches
      3. Updating on-going and standard searches
        1.  
          Updating on-going and standard searches from Mailbox
        2.  
          Updating an on-going or a standard search from Managed Accounts
      4.  
        Exporting a summary report of searched items
      5.  
        Deleting searches
    5. Working with searched emails
      1.  
        Applying tags and legal hold to emails
      2.  
        Applying labels to emails
      3.  
        Exporting searched emails
      4.  
        Exporting a search summary report for emails
      5.  
        Reassigning emails
      6.  
        Hiding and unhiding emails
      7.  
        Deleting emails permanently
    6. Working with searched collaboration messages
      1.  
        Searching collaboration messages during investigation
      2.  
        Applying tags and legal hold to collaboration messages
      3.  
        Applying labels to collaboration messages
      4.  
        Exporting collaboration messages
      5.  
        Exporting a search summary report for collaboration messages
    7. Working with searched files
      1.  
        Applying tags and legal hold to files
      2.  
        Applying labels to files
      3.  
        Exporting searched files
      4.  
        Exporting a search summary report for files
    8. Working with Advanced ECA searches
      1.  
        Creating an Advanced ECA search
      2.  
        Updating an Advanced ECA search
      3.  
        Filtering an Advanced ECA search
      4. Applying tags to the Advanced ECA search items
        1.  
          Applying tags to emails in Advanced ECA search
        2.  
          Applying tags to collaboration messages in Advanced ECA search
        3.  
          Applying tags to files in Advanced ECA search
      5. Applying labels to the Advanced ECA search items
        1.  
          Applying labels to emails in Advanced ECA search
        2.  
          Applying labels to collaboration messages in Advanced ECA search
        3.  
          Applying labels to files in Advanced ECA search
      6. Exporting the Advanced ECA search items
        1.  
          Exporting emails from Advanced ECA search
        2.  
          Exporting collaboration messages from Advanced ECA search
        3.  
          Exporting files from Advanced ECA search
      7. Exporting an Advanced ECA search summary report
        1.  
          Exporting summary report for emails
        2.  
          Exporting summary report for collaboration messages
        3.  
          Exporting summary report for files
      8.  
        Reassigning emails from the Advanced ECA search
      9.  
        Printing the selected Advanced ECA searched items
      10.  
        Deleting an Advanced ECA search
    9. About Mail Reassignment
      1.  
        Reassigning emails
      2.  
        Viewing email reassignment status
      3.  
        Canceling the email reassignment activity
      4.  
        Generating a Mail Reassignment status report
      5.  
        Viewing mail reassignment notifications and status reports
    10. About labels
      1.  
        Creating a label
    11. About legal holds
      1.  
        Viewing legally hold items
    12. About Tags
      1.  
        Updating tags
      2.  
        Removing items from tags
      3.  
        Deleting tags
  5. Managing cases
    1.  
      About cases
    2.  
      About case workflow summary: eDiscovery Administrator
    3.  
      Creating case review statuses
    4.  
      Creating cases
    5.  
      Viewing case details
    6.  
      Editing cases
    7. About searches in eDiscovery
      1.  
        Performing searches within cases
      2.  
        Saving searches in Review sets and Research sets
      3.  
        Modifying saved searches of cases
      4.  
        Applying a search-level legal hold
      5.  
        Assigning review sets to reviewers
      6.  
        Generating a search summary report
  6. Managing reviews
    1.  
      About reviewing cases
    2.  
      About case workflow summary: eDiscovery Reviewers
    3. Reviewing emails
      1.  
        Accessing emails for review
      2.  
        Applying tags to emails
      3.  
        Exporting emails
      4.  
        Exporting a search summary report for emails
      5.  
        Adding notes to emails
      6.  
        Applying review status to emails
      7.  
        Viewing audit history of emails
      8.  
        Printing emails
      9.  
        Restoring emails
      10.  
        Forwarding emails
    4. Reviewing collaboration messages
      1.  
        Accessing collaboration messages for review
      2.  
        Applying tags to collaboration messages
      3.  
        Applying legal hold to collaboration messages
      4.  
        Applying and removing review status to collaboration message
      5.  
        Exporting collaboration messages
      6.  
        Exporting a search summary report for collaboration messages
      7.  
        Adding notes to collaborative messages
      8.  
        Viewing audit history of collaborative messages
    5. Reviewing files
      1.  
        Accessing files for review
      2.  
        Applying tags to Files
      3.  
        Applying or removing legal hold to files
      4.  
        Applying and removing review status to files
      5.  
        Exporting files
      6.  
        Exporting a search summary report for files
      7.  
        Adding notes to files
      8.  
        Viewing audit history of files
      9.  
        Downloading files
  7. Managing exports
    1.  
      About exports
    2.  
      Performing exports in Investigation and eDiscovery
    3.  
      Reviewing Export Status
    4.  
      Resubmitting failed export items
    5.  
      Option to maintain folder structure in the export
    6.  
      Canceling Export Batch
    7.  
      Email export FAQ
  8. Collaborative reports
    1.  
      About collaborative eDiscovery reporting
    2.  
      Report by email: Audit trail
    3.  
      Report by Case: Case History
    4.  
      Report by Case: Case Summary
    5.  
      Report by Archive: eDiscovery dashboard
  9. Advanced eDiscovery alerts
    1.  
      Creating an alert
  10. Email Continuity
    1.  
      Managing Email Continuity
    2.  
      Viewing Continuity emails
  11. Methods for searching cases and accounts
    1.  
      About Advanced Search
    2.  
      Search syntax for Advanced Search
    3.  
      About stop words and special characters
    4.  
      Phrase searches
    5. Boolean operator searches
      1.  
        AND operator search
      2.  
        OR operator search
      3.  
        NOT operator search
      4.  
        About using multiple Boolean operators
      5.  
        About using Boolean operators with phrase searches
      6.  
        About Boolean operators and special characters
    6.  
      Wildcard searches
    7.  
      Proximity searches
    8.  
      Double-byte character set searches
    9.  
      About enhanced searches in Japanese
    10.  
      Searchable attachment types
    11.  
      Search examples and tips
  12. Methods for searching tables and reports
    1.  
      About Quick Search and Criteria Search
    2.  
      Searching tables, lists, and reports
  13. Advanced eDiscovery Frequently Asked Questions
    1.  
      Frequently Asked Questions
  14. Best practices, limitations, and known issues
    1.  
      Best practices and limitations with Advanced eDiscovery
    2.  
      Known issues with Advanced eDiscovery
  15. Advanced eDiscovery updates in previous releases
    1.  
      About the Advanced eDiscovery updates in previous releases

Search examples and tips

Examples of using Basic, Advanced, and Quick Search

Suppose that you want to search for the messages that relate to the resetting of a password. You can enter password reset into the Search box and click Search to perform a Search. The space between password and reset is treated as an AND operator, so the returned results contain any messages that include both the word password and the word reset.

Suppose that you now decide to search for the phrase password reset, and to exclude from the results any emails that reference the word Box. You can use an Advanced Search for this purpose. Click the expand icon to display the Advanced Search options. Your original Search is now shown in the first criteria row.

Insert double quotation marks around password reset to specify it as a phrase. Then click + to add a second criteria row. In the new criteria row, select Doesn't Contain and enter Box in the text field.

Click Search to perform the Advanced Search. The search returns any items that do not contain Box but that contain the exact phrase password reset.

You could obtain the same results if you entered the following term in the Search bar:

"password reset" NOT box

Table: List of query search terms lists some possible query search terms along with examples.

Table: List of query search terms

Search term

Data type

Description

Example

_All, Entiremessage

Text

Searches through all default fields. Similar to simple search or not specifying a field.

_All:(test or test2)

"hello world"

Entiremessage:test

Attachments.content

Text

Search by attachment content.

Attachments.content: "Hello World"

Attachments.extension

Text

Search by attachment file type (PDF, DOC, docx, and so on.)

Attachments.extension:docx

Attachments.filename

Text

Search by the file name of the attachment.

Attachments.filename:Report.PDF

Attcount

Integer

Search by the amount of attachments.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Attcount:6

Attflag

Boolean

Search by whether there is an attachment.

Attflag:true

Atttext

Text

Search the content of the attachments.

Atttext:Computers

Atttypes

Text

Search by the attachment type.

Atttypes:PDF

Cc

Text

Search by carbon copy recipients.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Cc:JoeBlogs@example.com

Sender:*@example.com

Classification.tags

Text

Search by classification tags.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Classification.tags:PII

Hidden

Boolean

Search whether email is visible to end user or not.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Email Hidden:

Hidden:(1)

Email Visible:

NOT Hidden:(1)

Inbound

Boolean

Search inbound emails.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Inbound:false

Ipheader

IP Address

Search by the IP header of the email.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Specific IP Address:

Ipheader:(10.201.1.1)

IP Address using wildcards:

Ipheader:(10.*.1.1) AND Ipheader:(10.201.?.1)

Maildate

Date Time

Search by the date the message was sent.

Closed Range:

Maildate: [2018-01-01T00:00:00 TO 2019-12-31T23:59:59]

Open Range:

Maildate: {2018-01-01T00:00:00 TO 2019-12-31T23:59:59}

Messagesizeinkb

Floating Point Number

Search by total size of the email.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Messagesizeinkb:[2.5 TO 5]

Outbound

Boolean

Search whether a user sent the email.

Note:

This query search term does not support the Searches for the Microsoft Teams messages.

Outbound:true

Sender

Text

Search by the sender address(es).

Sender:JoeBlogs@example.com

Sender:*@example.com

Subject

Text

Search by the subject of the email.

Subject:IT

Textbody

Text

Search the text content of the email.

Textbody: "Hello World!"

To

Text

Search by recipient.

To:JoeBlogs@example.com

To:*@example.com

Examples of Query Searches:

  • MailDate:[2016-05-14T05:00:00 TO 2019-06-18T08:00:00]

  • Messagesizeinkb:[0.0 TO 11.5]

  • Subject:(export OR report)

  • MailDate:[2016-05-14T05:00:00 TO 2019-06-18T08:00:00] AND subject:archive

  • Sender:(*@domain.com OR *@domain2.com OR *@domain3.com)

  • Atttypes:(pdf OR docx) AND atttext:process

  • Attachments.filename:(Report.PDF or Export.docx)

Searching the From, To, BCC and CC fields

The To, From, and From/To search options are available within an Advanced Search.

  • The To option provides search results from the To, BCC, and CC fields.

  • The From option provides search results from the From field.

  • The From/To option provides search results from the From and To fields.

Searching within specific email domains

One way to search for items within a specific domain is to enter the domain name in the To field of an Advanced Search.

You can use wildcards to search for results from a group of similar domains. For example mycloud* returns emails for the domains that begin with mycloud.